SOCI Act obligations

The Security of Critical Infrastructure Act 2018 (SOCI Act) sets legal obligations if you own, operate, or hold a direct interest in a critical infrastructure asset. The Cyber and Infrastructure Security Centre (CISC) is the regulator. What applies depends on your role and the asset class. This page is a high-level map, not a determination of whether you are in.

Start with scope. CISC lists eleven sectors: communications; financial services and markets; data storage or processing; defence industry; higher education and research; energy; food and grocery; healthcare and medical; space technology; transport; and water and sewerage. If your sector is not on that list, CISC says the Act likely does not apply. If it is, the question becomes whether you own, operate, or hold a direct interest in one of the asset classes the Act defines. Premises, computers and data that work together as one system or network are one asset; parts that run as separate systems, each meeting a definition, are separate assets. Draw that boundary before you touch the register.

CISC describes three positive security obligations that can apply, depending on asset class: provide operational and ownership information to the Register of Critical Infrastructure Assets (Part 2); report cyber incidents that have a relevant or significant impact on the asset (Part 2B); and adopt, maintain and comply with a written risk management program (Part 2A). There is also an obligation to notify data service providers (s 12F(3)).

Mandatory cyber incident reporting is Part 2B. Clocks run from when the responsible entity becomes aware: 12 hours if the incident has had or is having a significant impact on availability of the asset; 72 hours for other cyber incidents with a relevant impact. If you report orally, the written approved-form follow-up is 84 hours after the oral report for the 12-hour duty (s 30BC) and 48 hours after the oral report for the 72-hour duty (s 30BD). Detail, definitions, and who files sit on the SOCI cyber incident clock page.

Assets declared Systems of National Significance carry Enhanced Cyber Security Obligations: incident response plans, cyber security exercises, vulnerability assessments, and providing system information so government can keep a near-real-time threat picture. Government assistance measures exist for incidents that would cause serious harm to Australia's prosperity, national security, or defence. They are last-resort tools, not a retainer.

The 2024 reforms changed the map. The Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024 (the ERP Act) received Royal Assent on 29 November 2024 with the Cyber Security Act 2024. Schedules 1 to 4 and 6 commenced on 20 December 2024; Schedule 5 commenced on 4 April 2025. What moved: Schedule 1 clarifies that your obligations cover data storage systems holding business-critical data. Schedule 2 lets the Minister authorise the Home Affairs Secretary to issue action and information-gathering directions to deal with the consequences of any all-hazards incident, not only a technical cyber incident. Schedule 4 gives the regulator a formal written direction to fix seriously deficient parts of a Part 2A risk management program. Schedule 5 uplifts and clarifies telecommunications security obligations for critical telecommunications assets, backed by the Telecommunications Security and Risk Management Program Rules from 4 April 2025. Schedule 6 trims System of National Significance notification so only the responsible entity is told, not every direct interest holder.

Protected information is the trap. Schedule 3 of the ERP Act redefined protected information as confidential commercial information, or information whose disclosure could harm the public, the security of a critical infrastructure asset, or Australia's national security, defence or socioeconomic stability. Disclosing it is an offence unless the Act authorises the disclosure, and that applies to responsible entities as well as to government. It is not the same thing as the PROTECTED classification under the PSPF. Check the authorised-disclosure rules before register details, risk program content or incident specifics go into a vendor portal, a cyber insurance form, a board pack shared outside the entity, or a public statement.

If you think you might be a responsible entity, read the CISC obligation pages and the asset-class guidance. Do not guess yourself out of the Act. Do not treat a vendor questionnaire as a substitute for the register or the 12/72-hour clock.